Samsung Notes
CVE-2025-21066
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local app-level access on device
-
ExploitSupply crafted input to SPI decoder
-
ExecutionTrigger out-of-bounds read in Samsung Notes
-
ImpactLeak adjacent process memory or crash
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires LOCAL access to a Samsung device running Samsung Notes prior to version 4.4.30.63, plus low-level privileges (PR:L) - typically a malicious or compromised app on the same device, or a crafted file/note processed by the vulnerable SPI decoder component. No user interaction is required (UI:N). Exploitation is fundamentally LIMITED by the local attack vector: there is no remote or network-facing path, so an attacker must already have a foothold on the device. Devices updated to 4.4.30.63 or later are not affected. |
| Impact | This is a moderate-severity, low-urgency issue despite the 7.1 CVSS base score. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) establishes that exploitation requires LOCAL access and at least low privileges (PR:L) - i.e., a malicious or compromised app already running on the device, or local processing of attacker-controlled data - not remote network reach. EPSS is very low at 0.12% (2nd percentile), the CVE is NOT on CISA KEV, and no public exploit code was identified, so all exploitation signals point the same direction: no active exploitation and low near-term likelihood. The signals are mutually consistent rather than conflicting. One internal tension worth noting: the description characterizes this strictly as an out-of-bounds READ (information disclosure), which matches C:H, yet the vector also asserts A:H (high availability impact) - plausible because an OOB read can crash the Samsung Notes process, but the description does not explicitly state a denial-of-service outcome, so the A:H rating should be verified against Samsung's advisory. Net: real but low priority - patch in routine cycles rather than emergency response. |
| Exploit ScenarioDerived | A malicious or compromised Android app (or a crafted note/document opened in Samsung Notes) feeds specially crafted data to the SPI decoder, which reads past the bounds of an allocated buffer. The attacker's local code then recovers adjacent process memory - potentially leaking sensitive data from the Notes app - or triggers a crash. No public proof-of-concept exploit was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Out-of-bounds read in the SPI decoder of Samsung Notes prior to version 4.4.30.63 allows local attackers with low-level privileges to access out-of-bounds memory, potentially causing information disclosure and availability impact. This moderate-severity, low-urgency vulnerability requires local access (no remote vector) and no user interaction, and is limited to devices with the vulnerable app. No public exploit code exists, and the EPSS score is very low (0.12%, 2nd percentile), indicating minimal exploitation likelihood.
RemediationAI
Update Samsung Notes to version 4.4.30.63 or later. This is the primary fix provided by Samsung. The advisory is available at https://security.samsungmobile.com/serviceWeb.smsb?year=2025&month=10. If immediate update is not possible, restrict installation of untrusted apps on the device, as the vulnerability requires local access with low privileges (e.g., a malicious app). However, this is a compensating control and not a full mitigation. Additionally, avoid opening untrusted notes or files that may be processed by the SPI decoder. Note that the vulnerability is not remotely exploitable, so network-based defenses are not applicable.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The SPI decoder is a component in Samsung Notes that parses a proprietary data format (SPI). An out-of-bounds read (CWE-125) occurs when the decoder reads beyond the allocated buffer, potentially exposing sensitive memory contents or causing a crash. The CVSS vector indicates local attack vector (AV:L), low privileges required (PR:L), no user interaction (UI:N), and high confidentiality and availability impact (C:H/A:H). The CPE cpe:2.3:a:samsung:notes:*:*:*:*:*:*:*:* confirms the affected product, but the vendor advisory specifies the fix in version 4.4.30.63. The vulnerability was reported by mobile.security@samsung.com and is documented in the Samsung Mobile Security advisory for October 2025.
Know when Notes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local-only decoder flaw reachable by an on-device app, so AV:L/PR:L; out-of-bounds read discloses memory (C:H) and can crash the process (A:H), with no integrity impact (I:N).
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Out-of-bounds read in the SPI decoder in Samsung Notes prior to version 4.4.30.63 allows local attackers to access out-of-bounds memory.
Executive ViewAI
Samsung Notes, a widely used note-taking application on Samsung mobile devices, contains a high-severity vulnerability that could allow a local attacker with basic privileges to access sensitive information stored in the app's memory and disrupt note availability. This risk is confined to devices where the app is installed and requires an attacker to already have a foothold on the device, but successful exploitation could lead to unauthorized data disclosure. Leadership should be aware that no public exploit identified at time of analysis, no vendor-released patch identified at time of analysis, and exploitation likelihood is currently minimal per the very low EPSS score, yet affected employees remain exposed until mitigations are applied.
No vendor patch available. Interim mitigations include: restrict Samsung Notes usage on devices that handle sensitive corporate data; enforce MDM policies to prevent sideloading and limit app permissions; isolate Samsung Notes in a work profile or container; monitor for abnormal app behavior or memory access; and apply latest OS security updates. Review vendor advisory for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)NVD
Stack-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows remote attackers to execute arbitrary
A vulnerability in the MIME message handling of the HCL Notes v9 client could potentially be exploited by an unauthentic
A vulnerability in the MIME message handling of the Notes client (versions 9 and 10) could potentially be exploited by a
A vulnerability in the input parameter handling of HCL Notes v9 could potentially be exploited by an authenticated attac
Heap-based out-of-bounds write in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary c
Path traversal in Samsung Notes prior to version 4.4.21.62 allows local attackers to execute arbitrary code. Rated high
Out-of-bounds write in applying connected information in Samsung Notes prior to version 4.4.21.62 allows local attackers
Out-of-bounds write in appending paragraph in Samsung Notes prior to version 4.4.21.62 allows local attackers to potenti
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. Rated high
HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. Rated high s
A possible buffer overflow vulnerability in maetd_eco_cb_mode of libSPenBase library of Samsung Notes prior to Samsung N
GitHub PoC
Exploit-DB